UTM Parameters: The Complete Guide & Naming Convention

UTM parameters are short tags you append to a URL’s query string — `?utm_source=newsletter&utm_medium=email&utm_campaign=launch` — so that when someone clicks a link you control, your analytics knows exactly where that click came from. Without them, a click from your newsletter, a partner’s site and a paid ad can all collapse into vague buckets like “referral” or, worse, “direct.”

The name is a fossil: UTM stands for Urchin Tracking Module, from Urchin, the software Google bought in 2005 and turned into Google Analytics. The parameters outlived the product because every analytics tool — GA4, Plausible, BusinessMCP, all of them — reads the same five (plus a few newer GA4-specific ones documented in Google’s URL-builder reference).

GA4 also recognizes utm_id (a campaign ID for cost-data joins) and utm_source_platform, and defines two more (utm_creative_format, utm_marketing_tactic) that Google’s own docs note aren’t currently reported. For almost everyone, the working set is the first three — Google’s guidance is that source, medium and campaign should always travel together.

The most common corruption in UTM data is treating source and medium as interchangeable. The rule that keeps them straight: utm_medium is the category, utm_source is the specific instance. Medium answers “what kind of traffic is this?” — paid clicks (cpc), email, social. Source answers “from which platform, exactly?” — google, facebook, your newsletter tool.

This matters because channel reports group by medium first. Every analytics tool — including GA4’s default channel groups — classifies traffic into channels using rules that read the medium: `cpc` lands in Paid Search, `email` in Email, `paid_social` in Paid Social. Put “facebook” in the medium field and your paid social spend falls out of every channel rollup you’ll ever build.

UTM values are free text, which is their superpower and their curse: nothing stops half your team writing `Email`, the other half `e-mail`, and a contractor `E-Mail_Newsletter`. Analytics tools treat those as three different channels — values are case-sensitive and match exactly. The fix is not discipline; it’s a written convention everyone links from.

1. 1Lowercase everything, always. It’s the one rule that prevents the most damage, because case drift is invisible until the report splits.
2. 2Pick one delimiter and stick to it. We use hyphens inside values (spring-launch); underscores are fine too — just never both, and never spaces (they become %20 and read horribly in reports).
3. 3Use a fixed vocabulary for source and medium. These two fields should be picked from a short approved list, not invented per campaign. Only utm_campaign and utm_content are free-form.
4. 4Name campaigns so they sort: purpose plus date, like webinar-attribution-2026-09. Future-you filters by prefix; the year stops name collisions.
5. 5Don’t encode what another parameter already holds. utm_campaign=facebook-paid-spring duplicates source and medium into the campaign name and makes cross-channel campaign rollups impossible.
6. 6Build links with a spreadsheet or builder, not by hand. A shared sheet with dropdown-validated source/medium columns is the cheapest data-quality tool in marketing.

Here’s a convention doc you can copy into your team wiki verbatim and edit:

# UTM convention — <company>

Rules
1. lowercase only. hyphens inside values. no spaces.
2. utm_source + utm_medium come from the approved lists below. do not invent new ones
   without adding them here first.
3. utm_campaign = <purpose>-<detail>-<yyyy-mm>, e.g. webinar-attribution-2026-09
4. utm_content only when testing creatives: hero-cta, footer-link, variant-b
5. never add utm parameters to internal links (links between our own pages).

Approved utm_medium: cpc | paid_social | organic_social | email | referral | podcast | offline
Approved utm_source: google | facebook | instagram | linkedin | x | newsletter | outreach | <partner-name>

Example
https://example.com/pricing?utm_source=newsletter&utm_medium=email&utm_campaign=launch-2026-09&utm_content=hero-cta

Mistake one: UTMs on internal links. Tagging a link from your homepage to your pricing page restarts attribution mid-visit — most tools treat new campaign parameters as a new traffic source, so the visitor who arrived from a Google ad is suddenly credited to “homepage-banner.” UTMs belong only on external links pointing at your site. Internally, use plain paths and let the tool track navigation.

Mistake two: case and vocabulary drift. `Email`, `email` and `E-mail` become three rows; so do `linkedin` and `LinkedIn`. This is why the convention doc above exists, and why serious teams generate links from a validated sheet instead of typing them.

Mistake three: tagging inbound channels you don’t control. You can’t UTM-tag a Google organic result or someone else’s tweet of your link. Those are classified from the referrer, and when the referrer is missing you get dark traffic — we cover that whole mess in our dark funnel guide.

A UTM click follows the same pipeline in any decent analytics stack:

Two implementation details are worth knowing. First, first-touch persistence: BusinessMCP stores the first campaign parameters a visitor ever arrived with, so when they come back next week via a bookmark and buy, the revenue still credits the campaign that actually started the relationship — the mechanics are in our revenue attribution guide. Second, dark-social recovery: when a click arrives with a utm_source but no referrer (common from mobile apps), we derive the referrer host from the utm_source, so that traffic surfaces by name instead of vanishing into Direct.

One prerequisite for any of this: your analytics has to actually record the session. Ad blockers and tracking prevention silently drop a meaningful share of third-party analytics traffic — tagged or not — which is why this whole system works best on first-party, cookieless analytics. And for how UTMs fit into the bigger credit-assignment picture, start with our attribution models guide.